In reading about SAML 2.0, I see SAML 2.0 federation does not require any sort of permanent or even persistent connection between accounts at the identity provider and the service provider. If however you do want to make permanent connections for a list of identity provider and service provider accounts, then the ssoadm bulk federation commands can help.
Before You Start
Before you can run the bulk federation commands, first establish the relationship between accounts, and also set up the providers including installation of the ssoadm command.
Consider a case where the identity provider is at idp.example.org and the service provider is at sp.example.com. A demo user account has the Universal ID, id=demo,ou=user,dc=example,dc=org, on the identity provider. That maps to the Universal ID, id=demo,ou=user,dc=example,dc=com, on the service provider.
The ssoadm command then needs a file that maps local user IDs to remote user IDs, one per line, separated by the vertical bar character |. Each line of the file looks like this:
local-user-ID|remote-user-ID
In this example, starting on the service provider side, the line for the demo user reads:
id=demo,ou=user,dc=example,dc=com|id=demo,ou=user,dc=example,dc=org
All the users’ accounts mapped in your file must exist at the identity provider and the service provider when you run the commands to link them.
See the OpenAM Installation Guide for details on installing OpenAM and the ssoadm command. The OpenAM Administration Guide describes how to create hosted providers and register remote providers.
Linking Federated Accounts in Bulk
After everything is set up, you can link the accounts using the ssoadm bulk federation commands.
- Prepare the data with the
ssoadm do-bulk-federation command.
This example starts on the service provider side.
$ cat /tmp/user-map.txt
id=demo,ou=user,dc=example,dc=com|id=demo,ou=user,dc=example,dc=org
$ ssoadm do-bulk-federation --metaalias /sp \
--remoteentityid http://idp.example.org:8080/openam \
--useridmapping /tmp/user-map.txt \
--nameidmapping /tmp/name-map.txt \
--adminid amadmin --password-file /tmp/pwd.txt \
--spec saml2
Bulk Federation for this host was completed. To complete the
federation, name Id mapping file should be loaded to remote
provider.
- Copy the name ID mapping output file to the other provider.
$ scp /tmp/name-map.txt idp.example.org:/tmp/name-map.txt
openam@idp.example.org's password:
name-map.txt 100% 177 0.2KB/s 00:00
- Import the name ID mapping file with the
ssoadm import-bulk-fed-data command.
In this example, this step takes place on the identity provider side.
$ ssoadm import-bulk-fed-data \
--adminid amadmin --password-file /tmp/pwd.txt \
--metaalias /idp --bulk-data-file /tmp/name-map.txt
Bulk Federation for this host was completed.
The accounts are now linked.
Peter Major
